Changes in Third-Party Content on European News Websites aft er - GDPR - Tim Libert
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
F A C T S H E E T
August 2018
Changes in Third-Party Content
on European News Websites after
GDPR
Authors: Timothy Libert, Lucas Graves and Rasmus Kleis Nielsen
Introduction platform in April and July, a total of 10,168 page
loads, nearly 1 million content requests, and 2.7
This factsheet compares the prevalence of third-party
million cookies were captured and analysed. On
web content and cookies on a selection of European
this basis, we find that the overall number of third-
news websites one month before and one month after
party cookies on news sites is down 22%, including
the introduction of the EU General Data Protection
significant drops in advertising and marketing
Regulation (GDPR). In order to begin to understand
(14%) and social media (9%) cookies, and a seven
how news organisations may be adapting to the new
percentage point drop in the number of news sites
privacy framework, prominent news websites in seven
that host third-party social media content, such
countries (Finland, France, Germany, Italy, Poland,
as sharing buttons from Facebook or Twitter. (All
Spain, and the UK) were analysed during the months
results presented here reflect site activity prior
of April and July 2018 using a purpose-built software
to obtaining consent; the picture may change
tool, webXray, which traces the network of outside
dramatically once the user provides the affirmative
parties that load content — and potentially track
opt-in GDPR requires.) These changes suggest that
users — on a given web site.
some news organisations are responding to GDPR
either by obtaining consent for third-party tracking
This study builds on an earlier report, Third-Party Web
or by curbing the use of outside cookies in general.
Content on EU News Sites: Potential Challenges and Paths
to Privacy Improvement, which compared third-party
While there is no change in the overall percentage of
content on news sites with other popular websites
pages from news providers which contain some form
during the first three months of 2018. Our prior
of third-party content (99%) or third-party cookies
measurements revealed that news websites tend
(98%) and the average number of third-parties found
to have dramatically higher volumes of third-party
on each news site has remained fairly static, we find a
content and cookies than other popular websites. In
number of specific changes between April (pre-GDPR)
advance of GDPR we identified several steps news
and July (post-GDPR):
websites could take to improve user privacy, such
as migrating third-party services (like social media
• The number of third-party cookies per page
sharing tools) to function on a first-party basis.
dropped by 22% across all news sites. German
news sites, which had the second-lowest number
The current investigation finds that news websites
of cookies in April, exhibit the smallest change
in most countries studied are setting substantially
with 6% fewer cookies. UK news sites, which had
fewer cookies without user consent post GDPR.
the most cookies per page in April, had 45% fewer
Based on analysis of homepages from over 200
by July.
news sites loaded with the webXray software
|1|CHANGES IN THIRD-PARTY CONTENT ON EUROPEAN NEWS WEBSITES AFTER GDPR
• The percentage of news sites hosting third-party sharing, recommending related articles, and hosting
social media content, such as sharing buttons content such as videos. Depending on how data is
from Facebook or Twitter, dropped significantly, collected and used, such services may fall under the
from 84% in April to 77% in July. GDPR.
• Decreases in third-party cookies between April
and July vary by the type of content setting the Although the GDPR is a new law, it is an evolution of
cookie. Across our sample, on average, the number well-established approaches to privacy regulation
of cookies from design optimisation tools is down which give users control over how personal information
27%, advertising and marketing cookies down is collected and used. The GDPR places substantive
14%, and social media cookies down 9%. limits on how various categories of data may be
• The US-based technology companies Google processed and requires affirmative ‘opt-in’ from users in
(96%), Facebook (70%), and Amazon (57%) remain many cases, and can result in heavy fines for those who
present on the highest number of the news sites violate the law. Therefore, websites and third parties
in our sample; of these, only Facebook has seen which collect user data for purposes such as tailoring
a significant drop in reach after GDPR (down advertising may be required to obtain user consent
five percentage points). But most of the other before processing data collected on a given website.
companies with the widest presence in April have
seen significant drops in their post-GDPR reach, in
many cases of ten percentage points or more.
Website Selection and Third-Party
Content Measurement
Background: Third-Party Web
Seven countries were selected for this study to
Content represent a mix of population sizes and media
Modern websites are rarely self-contained and markets in the EU. The countries studied are Finland,
typically include a mix of first- and third-party content. France, Germany, Italy, Poland, Spain, and the United
First-party content is defined as material downloaded Kingdom. In each country, we included a selection of
from the address a user sees in their browser window, prominent news sites, chosen on the basis of prior
which is typically the outlet or organisation the user work measuring their reach and significance (Newman
intends to visit. For example, a website at the address et al., 2017). Please see the methods appendix for
‘http://example.com’ may contain a first-party image additional details on the site selection.
downloaded from ‘http://example.com/newsimage.
jpeg’. To measure the presence and nature of third-party
content on the selected websites, we used the open-
In contrast, third-party content is downloaded from source software tool webXray.1 This tool analyses a
a different address, and in many cases a different page by opening it in the Chrome web browser and
company, than the website a user is visiting. If ‘http:// creating a new user profile which has no cookies or
example.com’ includes a video which is hosted at the history. The software then loads the page in Chrome,
address ‘http://video-hosting.com/newsvideo.mp4’, during which time all requests for third-party content
this means ‘video-hosting.com’ is a third-party content are monitored. At no point is the browser interacted
host, and ‘newsvideo.mp4’ is third-party content. When with in any way, and no cookie or tracking consent
third-party content is present on a website, data about buttons are clicked. After waiting 30 seconds, webXray
the user’s browsing habits may be transferred to third extracts all cookies from the internal Chrome database,
parties, representing a potential impact on privacy. records them, and closes the browser. webXray may
miss some content requests due to a variety of factors,
Websites use third-party content for a variety of such as websites which block automated browsers.
purposes. Advertising and marketing are the best The measures produced by webXray are therefore
known, and such content often relies on ‘tracking’ low-bound measures and the true number of third
users’ web browsing in order to display advertisements parties on a given page may be higher.
tailored to users’ interests. Websites also use third
parties to assist with a variety of other functions such Two sets of data are compared in this factsheet,
as measuring the size and nature of the audience, drawn from measurements taken during the months
optimising website design, facilitating social media of April and July 2018. These months are chosen to
1
Those who wish to know more about webXray may visit the project website (https://webxray.org) and download the software (https://
github.com/timlib/).
|2|CHANGES IN THIRD-PARTY CONTENT ON EUROPEAN NEWS WEBSITES AFTER GDPR
represent samples one month before and one month we find wide variation. Five of the seven countries
after the introduction of the GDPR in the EU. For have experienced a drop in the average number of
more details on the sample and methods, please see third parties on news sites. The figure fell by 16% in
the appendix. France, 13% in the United Kingdom, 12% in Spain, 8%
in Finland, and 4% in Italy; Germany, where news sites
in April already had far fewer third-party domains
than most countries covered, experienced no change.
Top-Level Findings This suggests that while adjustments are happening
In our previous factsheet, based on data collected over in some countries, such changes are uneven and may
the first three months of 2018, we found that 99% of reflect varying interpretations of GDPR.
news websites included some form of third-party
content and 99% set at least one third-party cookie The average number of third-party cookies per page
(Libert and Nielsen, 2018). These broad measures has dropped by 22% over all per Figure 1, with wide
are unchanged between April and July — the use of variation across countries per Figure 3. German news
third-party content and cookies remains effectively sites, which had the second-lowest number of cookies
universal after GDPR. However, digging deeper into in April, exhibit the smallest change with 6% fewer
the data reveals a number of significant changes. cookies in July. UK news sites, which had the most
cookies in April, have 45% fewer cookies per page in
Figure 1. Third-party domains and cookies per July, placing them in fourth place among the seven
page (April-July change in parenthesis) countries examined. Spain, France, and Italy all have
over 30% fewer cookies. Once again it is important to
emphasise that these are cookies set without clicking
Cookie Counts on any cookie notifications; users who accept cookies
(-22%) will likely have more set.
While nearly all countries have either stayed the same
Content Counts or experienced drops, Poland has experienced a 29%
(-2%) rise in third parties per page and a 20% rise in third-
party cookies in aggregate. This is largely due to major
0 20 40 60 80 100 increases in four of the 29 websites examined. We may
not rule out that these sites may have changed in a way
April July
which has impacted our measurement tool, and when
excluding these four sites we find the average number
of cookies across the 25 remaining sites to be static,
Per Figure 1, the average number of cookies is down
hewing more closely to trends in other countries.
22% from April to July, though the number of third
parties found on a given page load fell from 41 to 40 in
At present it is not possible to state with certainty why
aggregate, a marginal change at best.
the changes we have observed are happening, and
some shifts may be unrelated to GDPR. However, it is
However, on a per-country basis, shown in Figure 2,
Figure 2. Third-party domains per page by country (April-July change in parenthesis)
Average (-4%)
United Kingdom (-13%)
Poland (+29%)
Italy (-4%)
France (-16%)
Finland (-8%)
Spain (-12%)
Germany (no change)
0 10 20 30 40 50 60
April July
|3|CHANGES IN THIRD-PARTY CONTENT ON EUROPEAN NEWS WEBSITES AFTER GDPR
Figure 3. Third-party cookies per page by country (April-July change in parenthesis)
Average (-22%)
United Kingdom (-45%)
Poland (+20%)
Italy (-32%)
France (-32%)
Finland (-19%)
Spain (-33%)
Germany (-6%)
0 20 40 60 80 100 120 140
April July
worth noting at least two likely factors. First, due to the Types of Third-Party Content
GDPR’s requirements for consent, news organisations
As noted above, third-party content is used for
may simply be deferring some tracking cookies until
different purposes, and the top-level findings obscure
after a user clicks to accept the site’s terms on a
more fine-grained shifts within common categories
pop-up consent dialogue. This could also mean that,
relied on in the news industry. Here again it is useful to
depending on the preferences of a given user, the
distinguish between the presence and the prevalence
number of cookies ultimately set may be similar —
of different kinds of content. As shown in Figure 4, we
but is then based on affirmative opt-in, as required for
saw almost no change in the percentages of pages
many kinds of data collection and processing under
with at least one instance of third-party advertising,
GDPR.
audience measurement, content recommendation,
design optimisation, and hosting.
Second, we may be observing a kind of “housecleaning”
effect. Modern websites are highly complex and
The only sizable shift was a fall of 7 percentage points
evolve over time in a path-dependent way, sometimes
(8%) in the share of sites with any third-party social
accumulating out-of-date features and code. The
media content — in other words, many news sites
introduction of GDPR may have provided news
don’t include even a single instance of content loaded
organisations with a chance to evaluate the utility of
from a social media firm — and a 6% decline in the
various features, including third-party services, and to
use of third-party content recommendation systems.
remove code which is no longer of significant use or
This change is in line with our prior report, which
which compromises user privacy. A closer look at the
suggested removing third-party social media content
types of content being removed provides some insight
as one possible step to reduce potential issues with
into this factor.
GDPR compliance.
Figure 4. Content cookie use (April-July change in parenthesis)
Social Media (-8%)
Hosting (-)
Design Optimisation (-)
Content Recommendation (-6%)
Audience Measurement (-2%)
Advertising and Marketing (-2%)
0 20 40 60 80 100
April July
|4|CHANGES IN THIRD-PARTY CONTENT ON EUROPEAN NEWS WEBSITES AFTER GDPR
Figure 5. Content cookie use (April-July change in parenthesis)
Social Media (-9%)
Hosting (-9%)
Design Optimisation (-27%)
Content Recommendation (+1%)
Audience Measurement (-7%)
Advertising and Marketing (-14%)
0 20 40 60 80 100
April July
Even though the types of content present have not appears to have declined, as can be seen from
changed dramatically overall, many types of content comparing Table 2 (showing the companies which
are now setting cookies without user consent at tracked the highest percentage of pages in April) and
lower rates. As shown in Figure 5, the percentage of Table 3 (with the same data for July).
instances of content which set a cookie has decreased
for four of six types of content, with advertising and Table 2. Percentage of news sites with content
marketing cookies down by 14%, design optimisation from company, April 2018
down by 27%, and social media down by 9%. Company Owner Percent pages
country tracked
Google (Alphabet) US 97
Prevalence of Specific Companies Facebook US 75
The software used for this study, webXray, is able to Amazon US 59
identify nearly 500 different companies and services Oath (Verizon) US 57
associated with third-party content. In both April AppNexus US 56
and July, Google, Facebook, and Amazon have the Rubicon Project US 56
widest presence across the European news sites Oracle US 53
analysed.
AdForm DK 53
Google, which was present on 97% of all the news comScore US 51
sites covered in April and 96% in July, hosts a variety WPP UK 50
of services, and as Table 1 shows, has seen some
slight decreases in reach when looking at specific Table 3. Percentage of news sites with content
services. from company, July 2018
Owner Owner Percent pages
Table 1. Percentage of sites with content from country tracked
Google subsidiaries and services Google (Alphabet) US 96
Service April July Facebook US 70
DoubleClick 89 87 Amazon US 57
Google Analytics 88 86 comScore US 55
Google Tag Manager 82 80 AppNexus US 50
AdSense 79 72 Oath (Verizon) US 44
Google APIs 70 69 Rubicon Project US 44
YouTube 13 11 AdForm DK 39
Google App Engine 4 4 The Trade Desk US 37
Criteo FR 35
Beyond Google, the overall reach of many companies
|5|CHANGES IN THIRD-PARTY CONTENT ON EUROPEAN NEWS WEBSITES AFTER GDPR
Among the top three, only Facebook has seen a References
significant drop in reach, but the reach of many other
Libert, T. 2018. An Automated Approach to Auditing
companies has declined more substantially. In April
Disclosure of Third-Party Data Collection in Website
all of the top ten companies tracked at least 50% of
Privacy Policies. In Proceedings of WWW 2018: The
pages, whereas in July only five companies do so. It is
2018 Web Conference (International World Wide Web
still the case that 8 of the top 10 companies are US-
Conference Committee), 207-16.
based, though Oath, AppNexus, Rubicon Project, and
Oracle (as well as the Danish advertising technology
Libert, T., and Nielsen, R. K. 2018. Third-Party Web
company AdForm and the UK-based WPP) have all
Content on EU News Sites: Potential Challenges and Paths
fallen from above to below the 50% mark.
to Privacy Improvement. Oxford: Reuters Institute for
the Study of Journalism.
As noted above, the prevalence of third-party social
media services on news sites has fallen substantially.
Newman, N., Fletcher, R., Kalogeropoulos, A., Levy, D.
A closer examination shows that declines vary
A. L., and Nielsen, R. K. 2017. Reuters Institute Digital
between social media services. Facebook’s presence
News Report 2017. Oxford: Reuters Institute for the
across news pages examined has dropped from 75%
Study of Journalism.
to 70%, Twitter’s from 31% to 29%, and that of AddThis
from 20% to 10%. The drop in AddThis usage has had
a particularly strong effect on parent company Oracle,
which has dropped from 53% to 32% of sites tracked Methods Appendix
overall.
For this study there are two main methodological
considerations: developing lists of sites to study, and
measuring privacy impacts. These steps are detailed
Conclusion below.
In our prior factsheet we noted that many websites in
Europe contained large volumes of third-party content
Site Selection
For each country, a list of news sites and popular
and cookies which could cause potential issues with
sites were selected for analysis. For news, prior work
GDPR compliance and more broadly raise privacy
conducted by the Reuters Institute for the Study
concerns. Likewise, we found that news websites
of Journalism was used to identify 30 news sites in
could face significantly greater challenges under
Germany, 33 in Spain, 20 in Finland, 30 in France, 31 in
GDPR than other popular websites because of their
Italy, 29 in Poland, and 31 in the UK.
heavy reliance on third parties. We recommended
migrating some third-party content to function on a
first-party basis, suggesting for example that social
Measuring Privacy Impacts
Once the list of pages was assembled, privacy impacts
media content be prioritised for migration.
were measured for the months of April and July 2018.
To do so, the open-source software tool webXray was
In this factsheet we compare third-party content and
used. This tool has been used extensively for academic
cookies in pre-GDPR (April) and post-GDPR (July) and
research (e.g. Libert, 2018). As noted above, for this
find many changes have occurred during this time
study webXray was configured to use the Chrome
period. While outside content and cookies are still
web browser. This browser was chosen as it is popular
found on virtually all news sites, we see somewhat
with users and it may be instrumented to run in an
less third-party content and significantly fewer third-
automated environment.
party cookies, with large variation by country and the
largest drops in the UK. Some of the biggest declines
To ensure that measurement reflected what users
have occurred in advertising and marketing cookies
would see in the European Union, a computer based
as well as social media content, indicating that news
at the University of Oxford in the United Kingdom
sites may have recognised the potential compliance
was used. This is particularly important in the context
risks posed by some of this content and removed it
of cookies as users in the EU have different legal
or tied it to affirmative opt-in from users. In sum, we
protections than users in other regions, such as the
find that the introduction of GDPR has been followed
US.
by significant reductions in the volume of third-party
cookies set without consent on many European news
sites.
|6|CHANGES IN THIRD-PARTY CONTENT ON EUROPEAN NEWS WEBSITES AFTER GDPR
About the authors
Timothy Libert is Special Faculty Instructor, Carnegie Mellon University and former Research Fellow at the Reuters Institute for the
Study of Journalism, University of Oxford.
Lucas Graves is Senior Research Fellow at the Reuters Institute for the Study of Journalism, University of Oxford.
Rasmus Kleis Nielsen is the Director of Research at the Reuters Institute for the Study of Journalism and Professor of Political
Communication, University of Oxford.
Published by the Reuters Institute for the Study of Journalism with the support of the Google News Initiative.
|7|You can also read
